# Vault.claimRewards can break if Convex changes the operator

Vault.claimRewards assumes Convex always mints CVX on CRV claims; if Convex's operator changes, mint silently returns and the claim reverts, blocking CRV and extra reward payouts.

- Payout: Contest reward
- Severity: medium
- Program: Amphora Protocol
- Credited: minhtrng
- Disclosed: 2024-04-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-amphora-findings/issues/414
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-amphora%3AM-01
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:business-logic vuln:reward-distribution

**Target:** Vault.claimRewards / Convex Cvx mint integration
**Root cause:** Vault.claimRewards unconditionally expects CVX to be minted proportional to CRV rewards, but Convex's Cvx.mint silently returns without minting when msg.sender != operator (shutdown case), so the assumed CVX balance never materializes.
**Steps:**
1. Observe Vault.claimRewards computes `_totalCvxReward += _calculateCVXReward(_crvReward)` and later transfers `_totalCvxReward` CVX to msg.sender.
2. Read Convex Cvx.mint: `if(msg.sender != operator){ return; }` — no revert, no mint on operator change/shutdown.
3. Trigger a claim after Convex changes operator: CRV is claimed but CVX is not minted.
4. The subsequent `CVX.transfer(_msgSender(), _totalCvxReward)` (or AMPHClaimer accounting) fails due to insufficient CVX balance, reverting the whole claim.
**How found:** Code-reading of the Convex Cvx.mint shutdown branch revealed it silently returns instead of reverting; comparing that against Vault.claimRewards' assumption that CVX is always minted exposed the mismatch.
**Insight:** When integrating with external reward/minter contracts, check whether their mint/transfer paths can silently no-op (early return) rather than revert; any downstream code that assumes a balance delta occurred will break. Verify balance deltas before/after rather than trusting computed amounts.